w3cj/auth-github-org

scanned 2026-08-06 · git 10e2aa9

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies43Known OSS vulnerabilities39Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 43 found · 1 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2018-3739 nodejs-https-proxy-agent: Unsanitized options passed to Buffer() allow for denial of service

yarn.lock

A package you depend on has a known security hole (CVE-2018-3739). Fix: Update that package to its patched version.
Worth fixing GHSA-j4mr-9xw3-c9jx Out-of-bounds Read in base64-url

yarn.lock

A package you depend on has a known security hole (GHSA-j4mr-9xw3-c9jx). Fix: Update that package to its patched version.
Worth fixing NSWG-ECO-434 Out-of-bounds Read

yarn.lock

A package you depend on has a known security hole (NSWG-ECO-434). Fix: Update that package to its patched version.
Worth fixing NSWG-ECO-428 Out-of-bounds Read

yarn.lock

A package you depend on has a known security hole (NSWG-ECO-428). Fix: Update that package to its patched version.
Worth fixing GHSA-rvg8-pwq2-xj7q Out-of-bounds Read in base64url

yarn.lock

A package you depend on has a known security hole (GHSA-rvg8-pwq2-xj7q). Fix: Update that package to its patched version.
Worth fixing CVE-2017-20165 A vulnerability classified as problematic has been found in debug-js d ...

yarn.lock

A package you depend on has a known security hole (CVE-2017-20165). Fix: Update that package to its patched version.
Worth fixing CVE-2024-29041 express: cause malformed URLs to be evaluated

yarn.lock

A package you depend on has a known security hole (CVE-2024-29041). Fix: Update that package to its patched version.
Worth fixing CVE-2018-16492 nodejs-extend: Prototype pollution can allow attackers to modify object properties

yarn.lock

A package you depend on has a known security hole (CVE-2018-16492). Fix: Update that package to its patched version.
Worth fixing CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor

yarn.lock

A package you depend on has a known security hole (CVE-2022-0155). Fix: Update that package to its patched version.
Worth fixing CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak

yarn.lock

A package you depend on has a known security hole (CVE-2022-0536). Fix: Update that package to its patched version.
Worth fixing CVE-2023-26159 follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()

yarn.lock

A package you depend on has a known security hole (CVE-2023-26159). Fix: Update that package to its patched version.
Worth fixing CVE-2024-28849 follow-redirects: Possible credential leak

yarn.lock

A package you depend on has a known security hole (CVE-2024-28849). Fix: Update that package to its patched version.
Worth fixing GHSA-r4q5-vmmm-2653 follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

yarn.lock

A package you depend on has a known security hole (GHSA-r4q5-vmmm-2653). Fix: Update that package to its patched version.
Worth fixing CVE-2017-16118 nodejs-forwarded: regular expression denial of service when parsing crafted user input

yarn.lock

A package you depend on has a known security hole (CVE-2017-16118). Fix: Update that package to its patched version.
Worth fixing CVE-2017-16119 nodejs-fresh: Regular expression denial of service when parsing crafted user input

yarn.lock

A package you depend on has a known security hole (CVE-2017-16119). Fix: Update that package to its patched version.
Worth fixing NSWG-ECO-388 Denial of Service

yarn.lock

A package you depend on has a known security hole (NSWG-ECO-388). Fix: Update that package to its patched version.
Worth fixing GHSA-pc5p-h8pf-mvwp Machine-In-The-Middle in https-proxy-agent

yarn.lock

A package you depend on has a known security hole (GHSA-pc5p-h8pf-mvwp). Fix: Update that package to its patched version.
Worth fixing NSWG-ECO-505 Man-in-the-Middle

yarn.lock

A package you depend on has a known security hole (NSWG-ECO-505). Fix: Update that package to its patched version.
Worth fixing CVE-2026-48038 joi: joi: Denial of Service via uncaught RangeError on deeply nested input through recursive link() schemas

yarn.lock

A package you depend on has a known security hole (CVE-2026-48038). Fix: Update that package to its patched version.
Worth fixing CVE-2022-23539 jsonwebtoken: Unrestricted key type could lead to legacy keys usagen

yarn.lock

A package you depend on has a known security hole (CVE-2022-23539). Fix: Update that package to its patched version.
Worth fixing CVE-2022-23540 jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass

yarn.lock

A package you depend on has a known security hole (CVE-2022-23540). Fix: Update that package to its patched version.
Worth fixing CVE-2022-23541 jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

yarn.lock

A package you depend on has a known security hole (CVE-2022-23541). Fix: Update that package to its patched version.
Worth fixing CVE-2025-65945 node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm

yarn.lock

A package you depend on has a known security hole (CVE-2025-65945). Fix: Update that package to its patched version.
Worth fixing CVE-2017-16138 nodejs-mime: Regular expression Denial of Service

yarn.lock

A package you depend on has a known security hole (CVE-2017-16138). Fix: Update that package to its patched version.
Worth fixing CVE-2017-18214 nodejs-moment: Regular expression denial of service

yarn.lock

A package you depend on has a known security hole (CVE-2017-18214). Fix: Update that package to its patched version.

… 18 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 39 found · 1 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-8g7p-74h8-hg48 Denial of Service in https-proxy-agent

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2018-3739). Fix: Update that package to its patched version.
Worth fixing GHSA-j4mr-9xw3-c9jx Out-of-bounds Read in base64-url

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-9vvw-cc9w-f27h debug Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2017-20165). Fix: Update that package to its patched version.
Worth fixing GHSA-qw6h-vgh9-j6wx express vulnerable to XSS via response.redirect()

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2024-43796). Fix: Update that package to its patched version.
Worth fixing GHSA-rv95-896h-c2vc Express.js Open Redirect in malformed URLs

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2024-29041). Fix: Update that package to its patched version.
Worth fixing GHSA-74fj-2j2h-c42q Exposure of sensitive information in follow-redirects

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2022-0155). Fix: Update that package to its patched version.
Worth fixing GHSA-cxjh-pqwp-8mfp follow-redirects' Proxy-Authorization header kept across hosts

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2024-28849). Fix: Update that package to its patched version.
Worth fixing GHSA-jchw-25xp-jwwc Follow Redirects improperly handles URLs in the url.parse() function

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2023-26159). Fix: Update that package to its patched version.
Worth fixing GHSA-pw2r-vq6v-hr8c Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2022-0536). Fix: Update that package to its patched version.
Worth fixing GHSA-r4q5-vmmm-2653 follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2026-40895). Fix: Update that package to its patched version.
Worth fixing GHSA-mpcf-4gmh-23w8 Regular Expression Denial of Service in forwarded

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2017-16118). Fix: Update that package to its patched version.
Worth fixing GHSA-9qj9-36jm-prpv Regular Expression Denial of Service in fresh

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2017-16119). Fix: Update that package to its patched version.
Worth fixing GHSA-c429-5p7v-vgjp hoek subject to prototype pollution via the clone function.

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2020-36604). Fix: Update that package to its patched version.
Worth fixing GHSA-jp4x-w63m-7wgm Prototype Pollution in hoek

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2018-3728). Fix: Update that package to its patched version.
Worth fixing GHSA-pc5p-h8pf-mvwp Machine-In-The-Middle in https-proxy-agent

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-q7cg-457f-vx79 joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2026-48038). Fix: Update that package to its patched version.
Worth fixing GHSA-8cf7-32gw-wr33 jsonwebtoken unrestricted key type could lead to legacy keys usage

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2022-23539). Fix: Update that package to its patched version.
Worth fixing GHSA-hjrf-2m68-5959 jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2022-23541). Fix: Update that package to its patched version.
Worth fixing GHSA-qwph-4952-7xr6 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2022-23540). Fix: Update that package to its patched version.
Worth fixing GHSA-869p-cjfg-cm3x auth0/node-jws Improperly Verifies HMAC Signature

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2025-65945). Fix: Update that package to its patched version.
Worth fixing GHSA-wrvr-8mpx-r7pp mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2017-16138). Fix: Update that package to its patched version.
Worth fixing GHSA-446m-mv8f-q348 Regular Expression Denial of Service in moment

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2017-18214). Fix: Update that package to its patched version.
Worth fixing GHSA-8hfj-j24r-96c4 Path Traversal: 'dir/../../filename' in moment.locale

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2022-24785). Fix: Update that package to its patched version.
Worth fixing GHSA-w9mr-4mfr-499f Vercel ms Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2017-20162). Fix: Update that package to its patched version.
Worth fixing GHSA-w9mr-4mfr-499f Vercel ms Inefficient Regular Expression Complexity vulnerability

/workdirs/scan-3fc9b6d6-a719-4e9c-bba5-08bb7030431d/yarn.lock

A package you depend on has a known security hole (CVE-2017-20162). Fix: Update that package to its patched version.

… 14 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.